GDPR and data deletion requests
How to handle donor data subject access and deletion requests under UK GDPR.
Your responsibilities as a data controller
When donors give to your charity through Kayana Aid, your organisation becomes a joint data controller for donor personal data (name, email, address, Gift Aid declaration). You must have a lawful basis for processing this data and must respond to data subject requests within 30 days under UK GDPR.
Handling deletion requests
If a donor requests deletion of their data, email support@kayana.co.uk with the donor's email address and the request details. Kayana Aid will anonymise the donor's personal data in the platform while retaining aggregate transaction records required for financial compliance.
Note: Gift Aid declaration records must be retained for 6 years under HMRC rules, even after a deletion request. Kayana Aid will inform the donor of this legal retention basis.
Data subject access requests
A donor can request a copy of all data held about them. Forward such requests to support@kayana.co.uk. We will compile the relevant data export and provide it within 30 days.
Was this article helpful?
Last updated July 2026 · Kayana Aid Support Team